Skip to contentSkip to conversation

devicetree: Fix buffer overflow on setting device node name

RFC PATCH In review Grant Likely 2 participants 2 messages Apr 8, 2010

lore
Share & tools
lore

Grant Likely

author
#0 lore raw

RFC PATCH 1/1 devicetree: Fix buffer overflow on setting device node name

Fix bug where temporary buffer for sprintf() was not large enough when setting a device tree node name.

Signed-off-by Grant Likely <grant.likely-s3s/[email protected]>

---

Hi Jeremy. Here's the fix I promised. With this change your current tree works beautifully. I've pushed out the kernel that works with this QEMU branch to my Linux kernel git tree:

git://git.secretlab.ca/git/linux-2.6 test-devicetree

Cheers,
g.

 hw/qdev.c   |    2 +-
 hw/sysbus.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
hw/qdev.c +1 -1
index caa5b35..36582ec 100644
@@ -868,7 +868,7 @@ static int qdev_fdt_add_device(void *fdt, DeviceState *dev, int bus_offset)
 {
     BusState *child;
     int dev_offset, rc;
-    char name[sizeof(dev->info->name) + 9];
+    char name[sizeof(dev->info->name) + 20];
     static int unique = 0;
 
     sprintf(name, "%s@%x", dev->info->name, unique++);
hw/sysbus.c +1 -1
index c63deef..c17d12d 100644
@@ -230,7 +230,7 @@ static int sysbus_fdt_populate_node(DeviceState *dev, void *fdt, int offset)
     for (i = 0; i < s->num_mmio; i++) {
         /* By convention, the name is appended with '@<first reg addr>' */
         if (i == 0) {
-            char n[sizeof(dev->info->name) + 10];
+            char n[sizeof(dev->info->name) + 20];
             sprintf(n, "%s@%x", dev->info->name, (uint32_t)s->mmio[i].addr);
             rc = fdt_set_name(fdt, offset, n);
             if (rc < 0)